CVE-2021-42000

Published: Feb 10, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

Affected (7)

Products: Pingidentity: Pingfederate

Pingidentity

1 product

Pingfederate

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Pingidentity Pingfederate	Up to 9.3.0
Pingidentity Pingfederate	From 10.0.0 to 10.0.11
Pingidentity Pingfederate	From 10.1.0 to 10.1.8
Pingidentity Pingfederate	From 10.2.0 to 10.2.6
Pingidentity Pingfederate	From 10.3.0 to 10.3.2
Pingidentity Pingfederate	Version 9.3.3
Pingidentity Pingfederate	Version 9.3.3 p15